Lifelock Brainblock, Lifeblock, Brainlock

McGrath probing service preventing identity theft
By ERIN MADISON
Tribune Staff Writer

The Montana Attorney General's office is investigating LifeLock, a company profiled in Sunday's Tribune.

LifeLock is an identity theft prevention service. Customers pay $10 per month to have a fraud alert placed on their credit reports and be opted out of pre-approved credit card offers. If one of LifeLock's members has their identity stolen, the company covers any losses up to $1 million.

LifeLock previously ran a full-page ad in the Tribune, which included the Social Security number of the company CEO Todd Davis.

That ad piqued the interest of Attorney General Mike McGrath, said Assistant Attorney General Jesse Laslovich.
"When that ad appeared, we started investigating them," Laslovich said, adding that so far nothing has come of the investigation.

The attorney general's office is sending the company a notice of a civil investigation, Laslovich said.

LifeLock is not aware of any state investigation, said Tami Nealy, director of communications for the company.

When McGrath saw Davis' Social Security number in the advertisement, he had concerns that it wasn't actually the CEO's Social Security number, Laslovich said.

Davis says he can give out his Social Security number because LifeLock is effective in preventing anyone from using it to commit fraud.

The Social Security number in the advertisement is registered to numerous people, Laslovich said. That's probably because people see it and try to use it to open lines of credit, he added.

The number in the advertisement is Davis' real Social Security number, Nealy said. Davis gets calls via the LifeLock service every two or three weeks notifying him that people are trying to open lines of credit in his name.

Every time the company prints Davis' Social Security number, it also gives a disclaimer saying people should protect their Social Security numbers and not share them, Nealy added.

The attorney general's office also has concerns about LifeLock because most of the services it offers are things people can do for free on their own, Laslovich said.

The company doesn't deny that, Nealy said.

"Everything we do for you, you can do yourself," she said.

However, the company offers convenience in that members don't have to do those things themselves, such as renew fraud alerts, which expire every 90 days.

"You can change your own oil; you just don't," Nealy said.

Laslovich recommends that people do thorough research before signing up with LifeLock — look over the contracts before signing them, be sure to understand what the company offers and go over everything with a fine-tooth comb.

Laslovich noted that with the increase in identity theft, there also are some businesses cropping up that may only claim to protect people from identity theft.

"We're just trying to be proactive," he said.

Reach Erin Madison at 791-1466, 800-438-6600 or emadison@greatfallstribune.com.

---

APRPEH has posted information and analysis concerning Lifelock in the past: here and here. Lifelock at least is honest in admitting that the services they provide can be done for free by anyone. The analogy of changing the car oil doesn't really apply. A fraud alert can be placed on all three credit files in under 3 minutes, faster if you are familiar with the touchpad sequence. Both Experian's and Equifax's websites are set up to take the alert online. This a very simple process with very little risk of a leaving your garage a filthy mess and your fragile male ego shattered. More troublesome is the Lifelock marketing:

LifeLock, the industry leader in proactive identity theft protection, offers a proven solution that prevents your identity from being stolen before it happens. We'll protect your identity and personal information for only $10 a month - and we guarantee our service up to $1,000,000. We also offer the only identity theft child protection program available in the market, so guarantee your good name today and enroll now.

Fraud alerts are only affective in preventing credit based fraud. Any new account opening or transaction where a credit report is not necessary by-passes the fraud alert protection. Utility companies for instance including many telecommunications and internet service providers rarely if ever utilize a credit report for new account openings.

The same claims about safety have been made by the credit freeze advocates. APRPEH discussed the credit freeze issue in November.

The Lifelock marketing brags about selling "the only identity theft child protection program available in the market." Why is that?

Lifelock claims:

Among the things we do:

• We check credit reports every 6 months to ensure that there is no activity.


• If a credit report does exist, we place fraud alerts on credit reports, stating that this is a minor child and that no activity should occur.


• We check for work history and any misuse of the Social Security number.


• We repeat this process regularly to ensure that all is well.


• Starting out is hard enough. Starting out with a stolen Identity makes it ten times harder. We think that's worth $25 a year. Do you?

APRPEH discussed the issues involving minors and their Social Security Numbers and Minors and Identity last year as well.

A good question for Attorney General Mike McGrath to ask is exactly what protecting is Lifelock doing? The product described on their website merely goes the process of determining if fraud has occurred using a minor's personal identifying information. To find out if a credit report exists for a minor, follow the instructions available from the Identity Theft Resource Center. In general, the credit bureaus will not knowingly produce and report credit history associated with a minor. Once the bureaus are aware that a credit file is associated with a minor they will either freeze the file or mark it accordingly. What the bureaus consider a minor is a different matter. A teen who is listed as an authorized user on a credit card likely has a credit file. Expecting a consistent answer from the bureaus as to why one minor should have a file and another shouldn't is asking for too much.

Wishing Good luck to General McGrath.

Identity Protection Shopping

Lifelock Vs TrustedID

By Puripong Koomsin

Each year, the cost of Identity Theft amounts to over 50 Million US Dollars and these numbers are steadily rising. Identity theft has been one of the most expensive crimes in the United States, costing both the government and individuals such a huge amount of money. Even though the crime is rising in numbers, most people still think that it may just be a result of isolated cases that have been blown out of proportion by the government and agencies that tend to gain from them.

That may seem like a convenient reality, in which one does not have to face the facts that everyday, a significant number of Americans are affected by Identity Theft all over the country. With cases and awareness growing, more and more firms offering protecting against identity theft are also popping up. Two firms that offer Identity Theft Protection Services are Lifelock and TrustedID. These firms claim to help their clients by informing them once their credits have been breached. So, how is each one different from the other? How does a prospective client know which firm is best for him?

Lifelock is a company that is based in Arizona. They offer their services for a monthly fee of $10 and an annual fee of $110. This company protects their clients by setting up fraud alerts with their client's creditors as well as removes a client's name from the mailing lists of pre-approved credit cards and junk mail. The company has become controversial in a way because of on one of their ads, CEO Todd Davis gives out his Social Security Number claiming that he is confident on how Lifelock works. Such an action has resulted in his number being hit several times by pranksters trying to prove that the Lifelock system is not as fool proof as they advertise it to be. In one scenario, a fraudster was able to solicit $500 from a credit company that did not check with Davis' credit history. This resulted in a blow for the company, but they claim that they have recovered and still have the clients that they used to and even more.

Another firm that is in the Identity Theft protection business is that of TrustedID. Unlike Lifelock, TrustedID takes a more curt approach when it comes to dealing with new accounts in their client's name. Instead of a simple monitoring of the account, TrustedID proceeds to freeze a client's account until the client verifies the fact that the new set up is valid or not. Like Lifelock, TrustedID also offers to remove a client's name from junk mailing lists. The company charges it clients $12.95 a month for their services.

So which is better: Lifelock or TrustedID? The answer to such query solely depends on the consumer. The two agencies work on a similar field with only a slight difference when it comes to the way they deal with breaches and new accounts instituted in a client's name. But, no matter what a firm may offer, an individual does not have to pay extra for the credit protection. The solution to that is for credit card agencies to make their process of freezing as well as unfreezing accounts easier for their users. This way, a client may be able to protect himself against Identity Fraud without using the services of any Identity Theft Protection agencies.

---

The writer of the above article is comparing services offered by two companies to which a consumer pays an on-going fee and the company provides a service for the consumer which is either free to do on their own or upon paying a moderate fee, can be implemented without too much effort.

Both companies are literally banking their money on the back of the Fair and Accurate Credit Transactions Act, (FACTA) which was an amendment to the Fair Credit Reporting Act (FCRA).

15 U.S.C. § 1681
§ 605A. Identity theft prevention; fraud alerts and active duty alerts
(a)One-call Fraud Alerts
(1)Initial alerts. Upon the direct request of a consumer, or an individual acting on behalf of or as a personal representative of a consumer, who asserts in good faith a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft, a consumer reporting agency described in section 603(p) that maintains a file on the consumer and has received appropriate proof of the identity of the requester shall--

(A)include a fraud alert in the file of that consumer, and also provide that alert along with any credit score generated in using that file, for a period of not less than 90 days, beginning on the date of such request, unless the consumer or such representative requests that such fraud alert be removed before the end of such period, and the agency has received appropriate proof of the identity of the requester for such purpose; and

(B)refer the information regarding the fraud alert under this paragraph to each of the other consumer reporting agencies described in section 603(p), in accordance with procedures developed under section 621(f).

The credit repositories, Equifax, Trans Union, and Experian are required by federal law to place a "fraud alert" on a consumer's credit file for no less than 90 days for free for as long as the consumer wishes to retain them. The fraud alert is placed by calling one of the credit bureaus at:

Equifax
888-766-0008

Experian
888-397-3742

TransUnion
800-680-7289

For most people, one call is enough to activate the alerts at all three credit bureaus. Exceptions would be people who have moved recently, have changed a piece of identity recently, (name or SSN) or alternate between a PO Box and other address.

The only catch is for the consumer to call every 90 days to renew the alerts. In addition to the alert statement being placed on the credit report, the alerts entitle a consumer to a free credit report. Reports are limited to two every 12 months. However, a carefully planned credit screening schedule could be arranged so that the consumer requests one report every two months. Add to this the annual credit report disclosure which gives a consumer one free report per 12 months from each bureau and a consumer can have up to nine (9) free credit reports per year! A schedule such as this, while not perfect is pretty effective to determine whether or not an identity theft attack is underway. Credit monitoring would be the best way to watch the credit reports but most effective when it is triple bureau monitoring.

Having said all that, new account related identity theft is only between 25%-30% of all identity theft, with utility and telecommunication based identity theft picking up a sizable amount of the difference. Medical, employment and criminal identity theft also add to the total. Most of these types of fraud are not prevented by the presence of fraud alerts on a credit report. Both of the above companies stake their business on managing the fraud alert process for consumers and therefore a consumer should not go to bed at night thinking that Lifelock or TrustedID will keep the ID Theft monster out of their nightmares.

As far as the opt out process advertised by TrustedID, a consumer can use the available internet resources here assembled by the Privacy Rights Clearinghouse.

Credit Freezes

TrustedID sells a product called "IDFreeze". The company claims for $7.95 a month, the consumer can let TrustedID intervene in freezing and thawing their credit report in the states where credit reports are available. However, recent changes in operating procedures at the big three bureau now makes credit freezes available to all US consumers even in the states where credit freeze laws have not been passed. The bottom line, the consumer is again paying for a manager not a magician. Freezes can be implemented by the consumer simply by going online to the bureaus websites and following the instructions to mail in a written request, id documents and a check, voila - a credit freeze until the consumer wishes to thaw it. APRPEH wrote about the new credit freeze option in November.

See a list of state specific identity and credit related laws here.

My name is Todd Davis
My social security number is 457-55-5462
I'm Todd Davis, CEO of LifeLock, and yes, that’s my real social security number*. Identity theft is one of the fastest growing crimes in America, victimizing over 10 million people a year and costing billions of dollars. So why publish my social security number? Because I’m absolutely confident LifeLock is protecting my good name and personal information, just like it will yours. And we guarantee our service up to $1 million dollars."

As for Lifelock, the article's writer left out a few notes of interest. He mentioned CEO Todd Davis had become a victim of identity theft. This is true. What he failed to mention is that Lifelock found out who the perpetrator was and seeking to capitalize on the publicity of how the crime took place, botched the police investigation which was subsequently dropped. Hurray for law and order. The writer failed to mention entirely that the co-founder of Lifelock, Robert Maynard was forced to step down due to ethical and legal problems related to his previous business in the credit world. APRPEH discussed this back in June of 2007.

As far as insurance goes, one could suppose it's not such a bad thing. The average consumer that resolves their own identity theft matter spends less than $500 out of pocket. This is the amount that could be claimed under the insurance policy. The consumer must weigh the cost of the premium for the insurance versus the likelihood of 1) needing the insurance and 2) spending more than the expected average in the event of an identity theft problem. Probably not a good idea.

The best bet for a consumer who wants id theft protection is to keep alerts on their credit file, subscribe to triple bureau monitoring and possibly subscribing to one of the services that offers real protection for a consumer in the event that an identity theft event should happen. Don't shop for an advisor or advocate but for someone who will actually work your id theft matter for you in the way an accountant does your taxes for you. For many consumers, no services are necessary. Contrary to what is normally printed, it is not that hard to re-establish your identity with a police report and early discovery. Shop carefully.

A False Sense of Security

Posted on Thu, Nov. 08, 2007

Agencies freeze credit reports to protect identities, curb theft
Last-ditch action offers new security

By Jan J. Kim
The Wall Street Journal

Spooked by the possibility of identity theft, increasing numbers of people are taking a radical approach to thwart criminals: They are putting their credit reports on permanent freeze.

A frozen credit report prevents almost anyone from using your name to take out a loan or sign up for credit, such as a credit card, a bank account or cell phone service. That is because, with a freeze in place, potential new creditors can't get access to your credit record kept on file by the three main credit-reporting bureaus without your explicit permission.

Michael Dana, a Dallas police detective, chose to freeze his credit reports after a Texas law took effect last month that made freezes available to all residents. Dana says he received several notices from financial institutions and the government saying that some of his personal information may have been compromised. "You can try to shred all your documents," says the 42-year-old. But "I'd rather shut my credit down and have the best security in place and not be a victim at all."

An estimated 50,000 to 70,000 people have so far signed up for credit freezes, according to the Consumer Data Industry Association, a trade group that includes the three credit bureaus.

Consumer groups expect that number will grow after the bureaus - Experian Group Ltd., TransUnion LLC and Equifax Inc. - recently announced plans to offer credit freezes nationwide by next month. The action comes after 39 states and the District of Columbia enacted laws in recent years allowing consumers to freeze their credit, though some states limit the option only to identity-theft victims.

Florida enacted a credit-freeze law last year, and Jimmy Glass and his wife signed up the same day. "Just the thought of someone else being able to assume your identity and rack up thousands of dollars in your name - that's just unthinkable," says Glass, of Orlando. "I have all the credit cards I need, no mortgage and no need for any car loans, so I just decided to shut it down."

Sometimes a brush with identity theft prompts people to take action. Dave Schreima of Long Beach, Calif., says someone recently got a hold of his bank-account number and started making unauthorized withdrawals. "I had already decided to freeze my records. That just kind of prompted me that this is the time to do it," says the 49-year-old retired computer programmer.

"New account fraud is more serious than people hijacking your current accounts because you can go for a very long time and not realize that there's an account in your name at a store you never shop in," says Claudia Bourne-Farrell, a spokeswoman at the Federal Trade Commission.

Freezing your credit can be cumbersome. You generally have to write a letter to each of the credit bureaus and pay a fee of about $10 to each. Although you can temporarily suspend the freeze, doing so could take several days and, in many cases, means paying more fees.

When your file is frozen, the bureaus assign you a personal identification number, which you will need to remove the freeze. To lift the freeze, you must notify the bureaus and specify the amount of time you want the lift in effect. With a fee of $10 per bureau in many states, it can cost a married couple as much as $60 to initiate a freeze across all three bureaus and another $60 to lift the freeze. Freezes are typically free for people who provide a police report confirming they were victims of identity theft.

The credit bureaus are generally promising to lift a credit freeze within three business days of receiving the request. But some states are forcing them to go further. Beginning next year, Utah and the District of Columbia, for instance, will require the bureaus to lift the freezes for state residents within 15 minutes. Keep in mind that even if you don't plan to borrow money, you may need to suspend a credit freeze to get an insurance policy, cell phone or utility service, an apartment or even a job.

Some states also are requiring the credit bureaus to charge lower fees in their states. As of last month, Indiana residents can request, lift or remove a freeze for free, while consumers in other places, such as Nebraska and Delaware, pay only a one-time fee to place the freeze with no additional costs to remove the freeze. Some states, including New York, New Jersey and Montana, require that bureaus charge fees of $5 or less.

Consumers can get more information on states' credit-freeze laws, along with general guidelines on how to place a freeze, at www.financial privacynow.org, a site run by Consumers Union.

The strategy isn't a total answer to identity theft: for example, a freeze won't stop someone from stealing your existing credit-card numbers and using them fraudulently. A freeze also doesn't prevent existing creditors and certain government or state and local agencies from accessing your credit files.

Identity-theft experts say that freezes are often best-suited for people who have little need to apply for new credit, such as children or for elderly parents, or for those who have already paid off their mortgages, car loans and credit cards. Even with a freeze in place, consumers can still order their own credit report. A freeze also doesn't lower an individual's credit scores.

Credit bureaus say there are less-cumbersome ways to prevent financial-identity theft. "File freezing is really the extreme measure," says Rod Griffin, Experian's manager of public education. "It can be the right thing for a person who has an extreme issue with identity theft, but if you freeze your credit file, you're removing yourself from the credit marketplace."

---

Soon, every American consumer will be able to place a freeze on their credit file, due to announced policy changes at three national credit repositories, (Equifax, Experian, and Trans Union). Before this policy change, only consumers in the 39 states where laws had been passed could freeze their credit. Probably sensing pending Federal legislation, the slow big 3 decided (individually, of course - wink wink) that the self-governing thing to do would be to proactively offer credit freezes to everyone not currently covered by a state law. So end of story, right?

The article above barely skims over the "other side of the story". A credit freeze is indeed an effective tool to stop identity theft when the perpetrator is using the PII "personal identifying information" of an innocent consumer for the purpose of opening new credit or charge accounts in order to purchase goods or services. Recent statistics show that credit card fraud is merely 28% of all identity theft related claims. Another 19% of the reported fraud is related to telephone and utility accounts while 18% is bank fraud and 13% employment fraud (which is only KNOWN employment fraud).



Credit freezes prevent a credit report from being accessed for the purpose of a new credit application. As pointed out in the article, a freeze will not stop an existing tradeline on the credit report from pulling follow up credit reports. But what about the records that appear in commonly used non-credit data sources such as Lexis-Nexis or Choicepoint? What if a perpetrator uses a victim's PII with an entity that merely verifies personal information using a non-credit data source?

The fact is that utilities (including cable and satellite television)
rarely if ever order credit reports before turning on service and cellular telephone services do not use credit reports nearly often enough before establishing new service. Where the article did not even venture in to is employment related identity theft. Many smaller employers, if not most, never run a credit report anymore. Most background checks for employment are based upon criminal searches, motor vehicle reports and locater searches. Here again, the credit freeze will not help prevent fraud.

I would not advise to a concerned consumer who has not experienced identity theft to forget about the freeze altogether since it would be effective in preventing SOME forms of identity related fraud. But, just because a consumer places a credit freeze on their credit file with each of the national credit repositories, it doesn't mean they are safe from fraud. Consumer's should still take protective steps to safeguard their PII. Losing sleep over the possibility of identity theft is not worth the effort. If it happens, it happens. But if you do lose sleep thinking about identity theft, the credit freeze will only save you a few winks.